Extracted

• • Target

    PAYMENT COPY-20211106_pdf.exe

  • Size

    308KB

  • MD5

    c288afa652187f51cd8a51225403b371

  • SHA1

    47da2c2d1f08cbdfa92576588f466b59da5645cb

  • SHA256

    34ef4f8cfb814da5aeb5f3181301976e3622470fd9bfbfec8c016e7eed215d8f

  • SHA512

    d1c0fbffa2523ba3f770034ce788597f37f7fab042c8d843219d4c053d0bf548e1562a24e6d7614285cafc329a5797f16b9b173eeb0f014f4ab81b43b677aac0

  Score

  10^/10

  warzoneratinfostealerpersistenceratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Sets DLL path for service in the registry

    persistence

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2